Merge remote-tracking branch 'origin' into irqdomain/next

1 files changed, 7 insertions, 8 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 372ec6502aa8..689fe2d22165 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2157,8 +2157,7 @@ static inline void flush_unauthorized_files(const struct cred *cred,
                                                 get_file(devnull);
                                         } else {
                                                 devnull = dentry_open(
-                                                        dget(selinux_null),
-                                                        mntget(selinuxfs_mount),
+                                                        &selinux_null,
                                                         O_RDWR, cred);
                                                 if (IS_ERR(devnull)) {
                                                         devnull = NULL;
@@ -2717,7 +2716,7 @@ static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
 
-        if (ia_valid & ATTR_SIZE)
+        if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
                 av |= FILE__OPEN;
 
         return dentry_has_perm(cred, dentry, av);
@@ -5763,21 +5762,21 @@ static struct nf_hook_ops selinux_ipv4_ops[] = {
         {
                 .hook =         selinux_ipv4_postroute,
                 .owner =        THIS_MODULE,
-                .pf =           PF_INET,
+                .pf =           NFPROTO_IPV4,
                 .hooknum =      NF_INET_POST_ROUTING,
                 .priority =     NF_IP_PRI_SELINUX_LAST,
         },
         {
                 .hook =         selinux_ipv4_forward,
                 .owner =        THIS_MODULE,
-                .pf =           PF_INET,
+                .pf =           NFPROTO_IPV4,
                 .hooknum =      NF_INET_FORWARD,
                 .priority =     NF_IP_PRI_SELINUX_FIRST,
         },
         {
                 .hook =         selinux_ipv4_output,
                 .owner =        THIS_MODULE,
-                .pf =           PF_INET,
+                .pf =           NFPROTO_IPV4,
                 .hooknum =      NF_INET_LOCAL_OUT,
                 .priority =     NF_IP_PRI_SELINUX_FIRST,
         }
@@ -5789,14 +5788,14 @@ static struct nf_hook_ops selinux_ipv6_ops[] = {
         {
                 .hook =         selinux_ipv6_postroute,
                 .owner =        THIS_MODULE,
-                .pf =           PF_INET6,
+                .pf =           NFPROTO_IPV6,
                 .hooknum =      NF_INET_POST_ROUTING,
                 .priority =     NF_IP6_PRI_SELINUX_LAST,
         },
         {
                 .hook =         selinux_ipv6_forward,
                 .owner =        THIS_MODULE,
-                .pf =           PF_INET6,
+                .pf =           NFPROTO_IPV6,
                 .hooknum =      NF_INET_FORWARD,
                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
         }